Threat Report H1 2025: ClickFix, disruptions, and ransomware deathmatch

In H1 2025, a new social engineering technique called ClickFix started reshaping the threat landscape, quickly becoming the latest craze among all kinds of threat actors and rising to #2 in ESET telemetry. In stark contrast to this surge, law enforcement disrupted two major infostealer-as-a-service operations: Lumma Stealer and Danabot. And of course, no threat report would be complete without ransomware—this time highlighted by dramatic, deathmatch-style infighting that brought down several players including the leading RansomHub. For more details, visit Welivesecurity.com and read the latest H1 2025 report – no paywall or registration required.

Discussed:

• ClickFix and FakeCaptcha 1:05
• Whack-a-hack, infostealer version 9:20
• Ransomware deathmatch 18:40

Host: Aryeh Goretsky, ESET Distinguished Researcher

Guest: Ondrej Kubovič, Security Awareness Specialist

Read more @WeLiveSecurity.com and @ESETresearch on Twitter

ESET Threat Report H1 2025